X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=vswitchd%2Fvswitch.xml;h=12780d6c1c7370945cc67ec5578535eaa8317d11;hb=7155fa52f0e585eb515ceebf3790d90554bbe18e;hp=64ad6c72e24f14541dc2972379cc6816685aa3c8;hpb=8b6ff72912871a8101a8427be1c38941326332ad;p=sliver-openvswitch.git diff --git a/vswitchd/vswitch.xml b/vswitchd/vswitch.xml index 64ad6c72e..12780d6c1 100644 --- a/vswitchd/vswitch.xml +++ b/vswitchd/vswitch.xml @@ -71,6 +71,93 @@ The Citrix XenServer universally unique identifier for the physical host as displayed by xe host-list. + + +

+ When ovs-vswitchd starts up, it has an empty flow table + and therefore it handles all arriving packets in its default fashion + according to its configuration, by dropping them or sending them to + an OpenFlow controller or switching them as a standalone switch. + This behavior is ordinarily desirable. However, if + ovs-vswitchd is restarting as part of a ``hot-upgrade,'' + then this leads to a relatively long period during which packets are + mishandled. +

+

+ This option allows for improvement. When ovs-vswitchd + starts with this value set as true, it will neither + flush or expire previously set datapath flows nor will it send and + receive any packets to or from the datapath. When this value is + later set to false, ovs-vswitchd will + start receiving packets from the datapath and re-setup the flows. +

+

+ Thus, with this option, the procedure for a hot-upgrade of + ovs-vswitchd becomes roughly the following: +

+
    +
  1. + Stop ovs-vswitchd. +
    2. +
  2. + Set + to true. +
    3. +
  3. + Start ovs-vswitchd. +
    4. +
  4. + Use ovs-ofctl (or some other program, such as an + OpenFlow controller) to restore the OpenFlow flow table + to the desired state. +
    5. +
  5. + Set + to false (or remove it entirely from the database). +
    6. +
+

+ The ovs-ctl's ``restart'' and ``force-reload-kmod'' + functions use the above config option during hot upgrades. +

+ + + +

+ A number of flows as a nonnegative integer. This sets number of + flows at which eviction from the datapath flow table will be + triggered. If there are a large number of flows then increasing this + value to around the number of flows present can result in reduced CPU + usage and packet loss. +

+

+ The default is 2500. Values below 100 will be rounded up to 100. +

+ + + +

+ Specifies userspace behaviour for handling flow misses. This takes + precedence over flow-eviction-threshold. +

+

+

+
auto
+
Handle automatically based on the flow-eviction-threshold and + the flow setup governer (default, recommended).
+
with-facets
+
Always create facets. Expensive kernel flow creation and + statistics tracking is always performed, even on flows with only + a small number of packets.
+
without-facets
+
Always handle without facets. Forces flow misses to be handled + in userspace. May cause an increase in CPU usage and packet loss + on high throughput.
+
+

+ @@ -340,7 +427,11 @@ - sFlow configuration. + sFlow(R) configuration. + + + + IPFIX configuration. @@ -543,20 +634,6 @@ datapath ID. - -

- A number of flows as a nonnegative integer. This sets number of - flows at which eviction from the kernel flow table will be triggered. - If there are a large number of flows then increasing this value to - around the number of flows present can result in reduced CPU usage - and packet loss. -

-

- The default is 1000. Values below 100 will be rounded up to 100. -

- - Option to allow forwarding of BPDU frames when NORMAL action is @@ -858,22 +935,6 @@ information such as destination MAC address, IP address, and TCP port. - -
stable
-
-

Deprecated and slated for removal in February 2013.

-

Attempts to always assign a given flow to the same slave - consistently. In an effort to maintain stability, no load - balancing is done. Uses a similar hashing strategy to - balance-tcp, always taking into account L3 and L4 - fields even if LACP negotiations are unsuccessful.

-

Slave selection decisions are made based on if set. Otherwise, - OpenFlow port number is used. Decisions are consistent across all - ovs-vswitchd instances with equivalent - - values.

-

These columns apply only to bonded ports. Their values are @@ -1147,6 +1208,10 @@ on a host. + + The MAC address in use by this interface. + +

Ethernet address to set for this interface. If unset then the default MAC address is used:

@@ -1248,36 +1313,29 @@ Same as IPSEC_GRE except 64 bit key. -
capwap
-
- An Ethernet tunnel over the UDP transport portion of CAPWAP (RFC - 5415). This allows interoperability with certain switches that do - not support GRE. Only the tunneling component of the protocol is - implemented. UDP ports 58881 and 58882 are used as the source and - destination ports respectively. CAPWAP is currently supported only - with the Linux kernel datapath with kernel version 2.6.26 or later. - - CAPWAP support is deprecated and will be removed no earlier than - February 2013. -
-
vxlan

An Ethernet tunnel over the experimental, UDP-based VXLAN protocol described at - http://tools.ietf.org/html/draft-mahalingam-dutt-dcops-vxlan-02. + http://tools.ietf.org/html/draft-mahalingam-dutt-dcops-vxlan-03. VXLAN is currently supported only with the Linux kernel datapath with kernel version 2.6.26 or later.

- As an experimental protocol, VXLAN has no officially assigned UDP - port. Open vSwitch currently uses UDP destination port 8472. - The source port used for VXLAN traffic varies on a per-flow basis - and is in the ephemeral port range. + Open vSwitch uses UDP destination port 4789. The source port used for + VXLAN traffic varies on a per-flow basis and is in the ephemeral port + range.

+
lisp
+
+ A layer 3 tunnel over the experimental, UDP-based Locator/ID + Separation Protocol (RFC 6830). LISP is currently supported only + with the Linux kernel datapath with kernel version 2.6.26 or later. +
+
patch
A pair of virtual devices that act as a patch cable. @@ -1294,8 +1352,7 @@

These options apply to interfaces with of gre, ipsec_gre, gre64, - ipsec_gre64, capwap, and - vxlan. + ipsec_gre64, vxlan, and lisp.

@@ -1310,22 +1367,67 @@

-

- Required. The tunnel endpoint. Unicast and multicast endpoints are - both supported. -

+

Required. The remote tunnel endpoint, one of:

+ +
    +
  • + An IPv4 address (not a DNS name), e.g. 192.168.0.123. + Only unicast endpoints are supported. +
    • +
  • + The word flow. The tunnel accepts packets from any + remote tunnel endpoint. To process only packets from a specific + remote tunnel endpoint, the flow entries may match on the + tun_src field. When sending packets to a + remote_ip=flow tunnel, the flow actions must + explicitly set the tun_dst field to the IP address of + the desired remote tunnel endpoint, e.g. with a + set_field action. +
    • +

- When a multicast endpoint is specified, a routing table lookup occurs - only when the tunnel is created. Following a routing change, delete - and then re-create the tunnel to force a new routing table lookup. + The remote tunnel endpoint for any packet received from a tunnel + is available in the tun_src field for matching in the + flow table.

- Optional. The destination IP that received packets must match. - Default is to match all addresses. Must be omitted when is a multicast address. +

+ Optional. The tunnel destination IP that received packets must + match. Default is to match all addresses. If specified, may be one + of: +

+ +
    +
  • + An IPv4 address (not a DNS name), e.g. 192.168.12.3. +
    • +
  • + The word flow. The tunnel accepts packets sent to any + of the local IP addresses of the system running OVS. To process + only packets sent to a specific IP address, the flow entries may + match on the tun_dst field. When sending packets to a + local_ip=flow tunnel, the flow actions may + explicitly set the tun_src field to the desired IP + address, e.g. with a set_field action. However, while + routing the tunneled packet out, the local system may override the + specified address with the local IP address configured for the + outgoing system interface. + +

    + This option is valid only for tunnels also configured with the + remote_ip=flow option. +

    +
    • +
+ +

+ The tunnel destination IP address for any packet received from a + tunnel is available in the tun_dst field for matching in + the flow table. +

@@ -1338,8 +1440,8 @@ key="in_key"/> at all.
  • - A positive 24-bit (for VXLAN), 32-bit (for GRE) or 64-bit (for - CAPWAP) number. The tunnel receives only packets with the + A positive 24-bit (for VXLAN and LISP), 32-bit (for GRE) or 64-bit + (for GRE64) number. The tunnel receives only packets with the specified key.
  • @@ -1365,8 +1467,8 @@ key="out_key"/> at all.
  • - A positive 24-bit (for VXLAN), 32-bit (for GRE) or 64-bit (for - CAPWAP) number. Packets sent through the tunnel will have the + A positive 24-bit (for VXLAN and LISP), 32-bit (for GRE) or 64-bit + (for GRE64) number. Packets sent through the tunnel will have the specified key.
  • @@ -1400,31 +1502,11 @@ system default, typically 64). Default is the system default TTL. - - Optional. If enabled, the Don't Fragment bit will be copied from the - inner IP headers (those of the encapsulated traffic) to the outer - (tunnel) headers. Default is disabled; set to true to - enable. - - - Optional. If enabled, the Don't Fragment bit will be set by default on - tunnel headers if the df_inherit option is not set, or if - the encapsulated packet is not IP. Default is enabled; set to - false to disable. - - - - Optional. Enable tunnel path MTU discovery. If enabled ``ICMP - Destination Unreachable - Fragmentation Needed'' messages will be - generated for IPv4 packets with the DF bit set and IPv6 packets above - the minimum MTU if the packet size exceeds the path MTU minus the size - of the tunnel headers. Note that this option causes behavior that is - typically reserved for routers and therefore is not entirely in - compliance with the IEEE 802.1D specification for bridges. Default is - disabled; set to true to enable. This feature is - deprecated and will be removed soon. + Optional. If enabled, the Don't Fragment bit will be set on tunnel + outer headers to allow path MTU discovery. Default is enabled; set + to false to disable. @@ -1586,15 +1668,15 @@ The source IP address used for an IPv4 tunnel end-point, such as - gre or capwap. + gre. - Egress interface for tunnels. Currently only relevant for GRE and - CAPWAP tunnels. On Linux systems, this column will show the name of - the interface which is responsible for routing traffic destined for the - configured . This could be an - internal interface such as a bridge port. + Egress interface for tunnels. Currently only relevant for GRE tunnels + On Linux systems, this column will show the name of the interface + which is responsible for routing traffic destined for the configured + . This could be an internal + interface such as a bridge port. + +

    + BFD, defined in RFC 5880 and RFC 5881, allows point to point + detection of connectivity failures by occasional transmission of + BFD control messages. It is implemented in Open vSwitch to serve + as a more popular and standards compliant alternative to CFM. +

    + +

    + BFD operates by regularly transmitting BFD control messages at a + rate negotiated independently in each direction. Each endpoint + specifies the rate at which it expects to receive control messages, + and the rate at which it's willing to transmit them. Open vSwitch + uses a detection multiplier of three, meaning that an endpoint + which fails to receive BFD control messages for a period of three + times the expected reception rate, will signal a connectivity + fault. In the case of a unidirectional connectivity issue, the + system not receiving BFD control messages will signal the problem + to its peer in the messages is transmists. +

    + +

    + The Open vSwitch implementation of BFD aims to comply faithfully + with the requirements put forth in RFC 5880. Currently, the only + known omission is ``Demand Mode'', which we hope to include in + future. Open vSwitch does not implement the optional + Authentication or ``Echo Mode'' features. +

    + + + When true BFD is enabled on this + , otherwise it's disabled. Defaults to + false. + + + + The fastest rate, in milliseconds, at which this BFD session is + willing to receive BFD control messages. The actual rate may be + slower if the remote endpoint isn't willing to transmit as quickly as + specified. Defaults to 1000. + + + + The fastest rate, in milliseconds, at which this BFD session is + willing to transmit BFD control messages. The actual rate may be + slower if the remote endpoint isn't willing to receive as quickly as + specified. Defaults to 100. + + + + Concatenated path down may be used when the local system should not + have traffic forwarded to it for some reason other than a connectivty + failure on the interface being monitored. When a controller thinks + this may be the case, it may set cpath_down to + true which may cause the remote BFD session not to + forward traffic to this . Defaults to + false. + + + + State of the BFD session. The BFD session is fully healthy and + negotiated if UP. + + + + True if the BFD session believes this may be + used to forward traffic. Typically this means the local session is + signaling UP, and the remote system isn't signaling a + problem such as concatenated path down. + + + + A short message indicating what the BFD session thinks is wrong in + case of a problem. + + + + State of the remote endpoint's BFD session. + + + + A short message indicating what the remote endpoint's BFD session + thinks is wrong in case of a problem. + +     +

    802.1ag Connectivity Fault Management (CFM) allows a group of @@ -1899,6 +2073,43 @@ compatibility with 802.1ag compliant implementations. Defaults to false. + + +

    + When true, and + is true, the CFM + module operates in demand mode. When in demand mode, traffic + received on the is used to indicate + liveness. CCMs are still transmitted and received, but if the + is receiving traffic, their absence does not + cause a connectivity fault. +

    + +

    + Demand mode has a couple of caveats: +

      +
    • + To ensure that ovs-vswitchd has enough time to pull statistics + from the datapath, the minimum + is 500ms. +
      • + +
    • + To avoid ambiguity, demand mode disables itself when there are + multiple remote maintenance points. +
      • + +
    • + If the is heavily congested, CCMs + containing the + status may be dropped causing changes in the operational state to + be delayed. Similarly, if CCMs containing the RDI bit are not + received, unidirectional link failures may not be detected. +
      • +
    +

    + + When down, the CFM module marks all CCMs it generates as @@ -1930,16 +2141,6 @@     - - Used in stable bond mode to make slave - selection decisions. Allocating values consistently across interfaces - participating in a bond will guarantee consistent slave selection - decisions across ovs-vswitchd instances when using - stable bonding mode. - - The LACP port ID of this . Port IDs are @@ -2009,6 +2210,11 @@ two different hypervisors. That is, active means that this is the active instance within a single hypervisor, not in a broader scope. + There is one exception: some hypervisors support ``migration'' from a + given hypervisor to itself (most often for test purposes). During + such a ``migration,'' two instances of a single might both be briefly marked + active on a single hypervisor.

    @@ -2890,9 +3096,11 @@

    Listens for SSL connections on the specified TCP port - (default: 6632). If ip, which must be expressed as an - IP address (not a DNS name), is specified, then connections are - restricted to the specified local IP address. + (default: 6632). Specify 0 for port to have the + kernel automatically choose an available port. If ip, + which must be expressed as an IP address (not a DNS name), is + specified, then connections are restricted to the specified local + IP address.

    The column in the ptcp:[port][:ip]

    Listens for connections on the specified TCP port - (default: 6632). If ip, which must be expressed as an - IP address (not a DNS name), is specified, then connections are - restricted to the specified local IP address. + (default: 6632). Specify 0 for port to have the kernel + automatically choose an available port. If ip, which + must be expressed as an IP address (not a DNS name), is specified, + then connections are restricted to the specified local IP address.

    When multiple managers are configured, the @@ -3053,6 +3262,14 @@ chosen connection.

    + + + When is ptcp: or + pssl:, this is the TCP port on which the OVSDB server is + listening. (This is is particularly useful when specifies a port of 0, allowing the kernel to + choose any available port.) +     @@ -3172,8 +3389,8 @@ -

    An sFlow(R) target. sFlow is a protocol for remote monitoring - of switches.

    +

    A set of sFlow(R) targets. sFlow is a protocol for remote + monitoring of switches.

    Name of the network device whose IP address should be reported as the @@ -3214,4 +3431,75 @@
    + +

    A set of IPFIX collectors. IPFIX is a protocol that exports a + number of details about flows.

    + + + IPFIX target collectors in the form + ip:port. + + + + For per-bridge packet sampling, i.e. when this row is referenced + from a , the rate at which packets should + be sampled and sent to each target collector. If not specified, + defaults to 400, which means one out of 400 packets, on average, + will be sent to each target collector. Ignored for per-flow + sampling, i.e. when this row is referenced from a . + + + + For per-bridge packet sampling, i.e. when this row is referenced + from a , the IPFIX Observation Domain ID + sent in each IPFIX packet. If not specified, defaults to 0. + Ignored for per-flow sampling, i.e. when this row is referenced + from a . + + + + For per-bridge packet sampling, i.e. when this row is referenced + from a , the IPFIX Observation Point ID + sent in each IPFIX flow record. If not specified, defaults to + 0. Ignored for per-flow sampling, i.e. when this row is + referenced from a . + + + + The overall purpose of these columns is described under Common + Columns at the beginning of this document. + + + +
    + + +

    A set of IPFIX collectors of packet samples generated by + OpenFlow sample actions.

    + + + The ID of this collector set, unique among the bridge's + collector sets, to be used as the collector_set_id + in OpenFlow sample actions. + + + + The bridge into which OpenFlow sample actions can + be added to send packet samples to this set of IPFIX collectors. + + + + Configuration of the set of IPFIX collectors to send one flow + record per sampled packet to. + + + + The overall purpose of these columns is described under Common + Columns at the beginning of this document. + + + +
    +